You have to wait at least 8 months (it varies) to get a suppressor when you buy one. You also have to submit passport photos, get finger printed by either the sheriff or police chief, and then wait. This is in addition to a regular NICS type check.
Also a $200 tax stamp for each suppressor. Again, someone COULD buy a manufactured suppressor legally and tie all their credit info and everything back but according to the news this shooter:
1. Traveled on a Greyhound bus from somewhere between Atlanta to New York in the past 5-10 days
2. Used a fake New Jersey driver's license to register at the hostel he was staying at
3. reportedly wore a mask indoors consistently while staying in the hostel
FYI these wait times are now down to about 2 weeks. The ATF decided to do the bare minimum of process improvements and had a ~10X increase in efficiency.
And you have to have a home address in a state where they are allowed... e.g. not NY. But yeah, I don't think it is incorrect to say they are "hard" to get, especially in context here.
